dsh-agent-plugins-market 0.6.0 → 0.6.2

package/lib/catalog/surfaces.js

@@ -9,12 +9,13 @@
  * fail-closed: broken files produce a diagnostic and are skipped, never a
  * thrown discovery.
  */
-import { readFile, readdir, realpath, stat } from 'node:fs/promises';
-import { join, resolve } from 'node:path';
+import { readFile, readdir, stat } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
 import { parseSkillFrontmatter } from './skills-parse.js';
 import { isDirectory } from './paths.js';
 import { validateMcpJson } from './validate.js';
-import { declaredMcpServers } from './manifests.js';
+import { readManifest } from './manifests.js';
+import { componentDocuments, componentPath, firstComponentFile } from './component-files.js';
 const DOT_DIRS = new Set(['.git', '.github', '.claude', '.cursor', '.kimi', '.plugin', '.sources', 'node_modules']);
 /**
  * Resolve a manifest-declared skills path into absolute directories (string or
@@ -22,35 +23,22 @@ const DOT_DIRS = new Set(['.git', '.github', '.claude', '.cursor', '.kimi', '.pl
  * declared path may be (or pass through) a symlink whose target leaves the
  * suite root, which lexical resolution cannot see.
  */
-async function declaredSkillDirs(root, declared) {
+async function declaredSkillDirs(root, declared, errors) {
     const values = Array.isArray(declared) ? declared : [declared];
     const dirs = [];
-    const realRoot = await realpath(root).catch(() => root);
     for (const value of values) {
-        if (typeof value !== 'string' || value === '')
+        if (typeof value !== 'string' || value === '') {
+            if (declared !== undefined)
+                errors.push('skills: paths must be non-empty strings');
             continue;
+        }
         const cleaned = value.replace(/^\.\//, '');
-        const path = resolve(root, cleaned);
-        // A missing path is not an escape; the discovery walk reports it absent.
-        const realPath = await realpath(path).catch(() => undefined);
-        if (realPath === undefined)
-            continue;
-        if (isWithin(realRoot, realPath))
+        const path = await componentPath(root, cleaned, errors);
+        if (path !== undefined)
             dirs.push(path);
     }
     return dirs;
 }
-/**
- * Whether `candidate` stays inside `root` once both are resolved. Callers pass
- * resolved paths: a sibling directory (`<root>-evil`) and any `../` escape
- * must be rejected — a bare string-prefix test admits both.
- */
-function isWithin(root, candidate) {
-    if (candidate === root)
-        return true;
-    const separator = candidate.includes('\\') && !candidate.includes('/') ? '\\' : '/';
-    return candidate.startsWith(`${root}${separator}`);
-}
 /** Discover SKILL.md files under the suite's skills directory, up to 3 levels deep. */
 export async function discoverSkills(root, errors, declared) {
     const skills = [];
@@ -59,13 +47,13 @@ export async function discoverSkills(root, errors, declared) {
     const rootParsed = await parseOneSkill(rootSkill, root, rootName, errors);
     if (rootParsed !== undefined)
         skills.push(rootParsed);
-    const skillsDirs = await declaredSkillDirs(root, declared);
-    if (skillsDirs.length === 0) {
+    const skillsDirs = await declaredSkillDirs(root, declared, errors);
+    if (declared === undefined) {
         const fallback = join(root, 'skills');
         if (await isDirectory(fallback))
             skillsDirs.push(fallback);
     }
-    const seen = new Set();
+    const seen = new Set(skills.map(skill => skill.name));
     const pushUnique = (skill) => {
         if (skill === undefined || seen.has(skill.name))
             return;
@@ -73,6 +61,13 @@ export async function discoverSkills(root, errors, declared) {
         skills.push(skill);
     };
     for (const skillsDir of skillsDirs) {
+        if (await isFile(skillsDir)) {
+            pushUnique(await parseOneSkill(skillsDir, dirname(skillsDir), '', errors));
+            continue;
+        }
+        for (const name of await listMdFiles(skillsDir)) {
+            pushUnique(await parseOneSkill(join(skillsDir, name), skillsDir, name.replace(/\.md$/, ''), errors));
+        }
         // A declared path may be one skill directory (a manifest listing
         // individual skills, e.g. mattpocock) or a container of skills.
         if (await isFile(join(skillsDir, 'SKILL.md'))) {
@@ -152,29 +147,48 @@ async function parseOneSkill(file, directory, fallbackName, errors) {
     return { ...verdict, directory };
 }
 /** Read the suite's MCP config: `mcp.json` or `.mcp.json`, else the winning manifest's inline `mcpServers`. */
-export async function discoverMcp(root, errors) {
-    for (const name of ['mcp.json', '.mcp.json']) {
-        const path = join(root, name);
-        if (!(await isFile(path)))
-            continue;
-        let raw;
-        try {
-            raw = JSON.parse(await readFile(path, 'utf8'));
-        }
-        catch (error) {
-            errors.push(`${name} unparsable: ${error instanceof Error ? error.message : String(error)}`);
+export async function discoverMcp(root, errors, manifest) {
+    const resolved = manifest ?? (await readManifest(root, errors, undefined));
+    const layout = resolved?.layout;
+    const names = layout === 'zcode'
+        ? ['.mcp.json']
+        : layout === 'qoder'
+            ? ['.mcp.json', 'mcp.json']
+            : layout === 'github-copilot' || layout === 'universal'
+                ? ['.mcp.json', '.github/mcp.json', 'mcp.json']
+                : layout === 'codex' || layout === 'claude-code'
+                    ? ['.mcp.json', 'mcp.json']
+                    : layout === 'cursor'
+                        ? ['mcp.json']
+                        : ['mcp.json', '.mcp.json'];
+    const declared = resolved?.components?.mcpServers;
+    const fallback = layout === 'kimi' ? undefined : await firstComponentFile(root, names);
+    const additive = layout === 'zcode' || layout === 'claude-code';
+    const values = declared === undefined
+        ? fallback === undefined
+            ? []
+            : [fallback]
+        : [...(additive && fallback !== undefined ? [fallback] : []), ...(Array.isArray(declared) ? declared : [declared])];
+    if (values.length === 0)
+        return undefined;
+    const documents = await componentDocuments(root, values, errors);
+    if (documents === undefined)
+        return undefined;
+    const servers = Object.create(null);
+    let schema = '';
+    for (const document of documents) {
+        const isBareFile = document.path === join(root, 'mcp.json');
+        const strict = isBareFile && (layout === 'agent-plugin-v1' || (declared === undefined && layout !== 'cursor' && layout !== 'qoder'));
+        const result = await validateMcpJson(root, document.value, { strict });
+        errors.push(...result.errors);
+        if (result.config === undefined)
             return undefined;
+        if (result.config !== undefined) {
+            Object.assign(servers, result.config.servers);
+            schema = result.config.schema;
         }
-        const result = await validateMcpJson(root, raw, { strict: name === 'mcp.json' });
-        errors.push(...result.errors);
-        return result.config;
     }
-    const inline = await declaredMcpServers(root);
-    if (inline === undefined)
-        return undefined;
-    const result = await validateMcpJson(root, { mcpServers: inline }, { strict: false });
-    errors.push(...result.errors);
-    return result.config;
+    return { schema, servers };
 }
 /** Count surfaces for a suite; mcp counts only validated servers, lsp counts inline servers plus directory entries. */
 export async function countSurfaces(root, skills, mcp, lsp) {

package/lib/catalog/validate.js

@@ -14,6 +14,7 @@ import { fileURLToPath } from 'node:url';
 // The 2020-12 dist build's d.ts resolves to a CJS namespace under NodeNext;
 // the runtime default export is the class itself (module.exports = Ajv2020).
 import Ajv2020Default from 'ajv/dist/2020.js';
+import { PLUGIN_ROOT_VARIABLES, PLUGIN_DATA_VARIABLES } from '../model/layouts.js';
 const SCHEMAS_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'schemas', '1.0.0');
 const Ajv2020Class = Ajv2020Default;
 export const PLUGIN_SCHEMA_ID = 'https://agent-plugins.org/schemas/1.0.0/plugin.schema.json';
@@ -51,7 +52,7 @@ export function isRecognizedSchema(value) {
  * @returns `undefined` when contained, or the rejection reason.
  */
 export async function pathContainmentError(pluginRoot, value) {
-    const raw = value.replace(/^\$\{PLUGIN_ROOT\}(\/|$)/, './');
+    const raw = value.replace(/^\$\{([A-Z_]+)\}(\/|$)/, (match, name) => (PLUGIN_ROOT_VARIABLES.has(name) ? './' : match));
     if (!raw.startsWith('./'))
         return `path "${value}" must begin with "./" (or ${'${PLUGIN_ROOT}'})`;
     const candidate = resolve(pluginRoot, raw.slice(2));
@@ -118,7 +119,7 @@ export async function validateMcpJson(pluginRoot, raw, options) {
         }
         servers = record;
     }
-    const valid = {};
+    const valid = Object.create(null);
     for (const [name, value] of Object.entries(servers)) {
         if (typeof value !== 'object' || value === null) {
             errors.push(`server "${name}": not an object`);
@@ -127,7 +128,7 @@ export async function validateMcpJson(pluginRoot, raw, options) {
         const server = value;
         // Claude Code dialects: `http`/`streamable-http` are the same remote
         // transport, and `local` or a missing `type` (with `command`) mean stdio.
-        let type = typeof server.type === 'string' ? server.type : server.command !== undefined ? 'stdio' : undefined;
+        let type = typeof server.type === 'string' ? server.type : server.command !== undefined ? 'stdio' : !strict && 'url' in server ? 'streamable-http' : undefined;
         if (type === 'local')
             type = 'stdio';
         if (type === 'http')
@@ -146,17 +147,21 @@ export async function validateMcpJson(pluginRoot, raw, options) {
             errors.push(`server "${name}": stdio servers require a command`);
             continue;
         }
-        if (stdioServer.command.includes('/')) {
-            if (!stdioServer.command.startsWith('./')) {
-                problems.push(`command "${stdioServer.command}" must be a bare executable name or a plugin-relative path beginning with "./"`);
+        const command = stdioServer.command.replace(/^\$\{([A-Z_]+)\}\//, (match, name) => (PLUGIN_ROOT_VARIABLES.has(name) ? './' : match));
+        if (options?.pathMode !== 'project' && command.includes('/')) {
+            if (!command.startsWith('./')) {
+                problems.push(`command "${command}" must be a bare executable name or a plugin-relative path beginning with "./"`);
             }
             else {
-                const reason = await pathContainmentError(pluginRoot, stdioServer.command);
+                const reason = await pathContainmentError(pluginRoot, command);
                 if (reason !== undefined)
                     problems.push(reason);
             }
         }
-        if (stdioServer.cwd !== undefined && !stdioServer.cwd.startsWith('${PLUGIN_DATA}')) {
+        if (stdioServer.cwd !== undefined && typeof stdioServer.cwd !== 'string') {
+            problems.push('cwd must be a string');
+        }
+        else if (options?.pathMode !== 'project' && stdioServer.cwd !== undefined && ![...PLUGIN_DATA_VARIABLES].some(name => stdioServer.cwd.startsWith(`\${${name}}`))) {
             // `.` is the Codex dialect spelling for the plugin root.
             const cwd = stdioServer.cwd === '.' ? './' : stdioServer.cwd;
             const reason = await pathContainmentError(pluginRoot, cwd);
@@ -167,7 +172,7 @@ export async function validateMcpJson(pluginRoot, raw, options) {
             errors.push(...problems.map(problem => `server "${name}": ${problem}`));
         }
         else {
-            valid[name] = { ...server, type: 'stdio' };
+            valid[name] = { ...server, command, type: 'stdio' };
         }
     }
     return { config: { schema: typeof record['$schema'] === 'string' ? record['$schema'] : 'native-client', servers: valid }, errors };
@@ -177,9 +182,9 @@ export async function validateMcpJson(pluginRoot, raw, options) {
  *  `${NAME:-default}` fallbacks are honored for unset/empty env vars. */
 export function expandPlaceholders(value, pluginRoot, pluginData, env = process.env) {
     return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g, (match, name, fallback) => {
-        if (name === 'PLUGIN_ROOT' || name === 'CLAUDE_PLUGIN_ROOT')
+        if (PLUGIN_ROOT_VARIABLES.has(name))
             return pluginRoot;
-        if (name === 'PLUGIN_DATA' || name === 'CLAUDE_PLUGIN_DATA')
+        if (PLUGIN_DATA_VARIABLES.has(name))
             return pluginData;
         return env[name] || fallback || '';
     });

package/lib/contracts/market.js

@@ -5,10 +5,15 @@ export const MARKET_API_PREFIX = '/api/agent-plugins/';
 export const MARKET_ROUTES = {
     overview: `${MARKET_API_PREFIX}overview`,
     mcpStatus: `${MARKET_API_PREFIX}mcp-status`,
+    addMcpServer: `${MARKET_API_PREFIX}mcp-servers/add`,
     lspStatus: `${MARKET_API_PREFIX}lsp-status`,
     lspServers: `${MARKET_API_PREFIX}lsp-servers`,
+    addLspServer: `${MARKET_API_PREFIX}lsp-servers/add`,
+    serverConfig: `${MARKET_API_PREFIX}server-config`,
+    saveServerConfig: `${MARKET_API_PREFIX}server-config/save`,
     progress: `${MARKET_API_PREFIX}progress`,
     config: `${MARKET_API_PREFIX}config`,
+    modelCatalog: `${MARKET_API_PREFIX}model-catalog`,
     suite: `${MARKET_API_PREFIX}suite`,
     skill: `${MARKET_API_PREFIX}skill`,
     addSource: `${MARKET_API_PREFIX}sources/add`,
@@ -25,8 +30,18 @@ export const MARKET_ROUTES = {
     mcpRetry: `${MARKET_API_PREFIX}mcp-retry`,
     mcpReauthorize: `${MARKET_API_PREFIX}mcp-reauthorize`,
     mcpBackend: `${MARKET_API_PREFIX}mcp-backend`,
-    setMcpBackend: `${MARKET_API_PREFIX}set-mcp-backend`
+    setMcpBackend: `${MARKET_API_PREFIX}set-mcp-backend`,
+    userPanel: `${MARKET_API_PREFIX}user-panel`
 };
+/** Build one user-panel list route URL (`GET`, no mutation). */
+export function userPanelRoute(kind) {
+    return `${MARKET_ROUTES.userPanel}/${kind}`;
+}
+/** Build one user-panel mutation route URL (all POSTs). */
+export function userPanelMutationRoute(kind, mutation, name) {
+    const base = `${userPanelRoute(kind)}/${mutation}`;
+    return name === undefined ? base : `${base}?name=${encodeURIComponent(name)}`;
+}
 /** Build a suite-detail URL without duplicating route or query encoding logic. */
 export function suiteRoute(sourceId, suiteId) {
     return `${MARKET_ROUTES.suite}?sourceId=${encodeURIComponent(sourceId)}&suiteId=${encodeURIComponent(suiteId)}`;

package/lib/index.js

@@ -1,38 +1,62 @@
 import { Catalog } from './application/catalog.js';
 import { RuntimeReconciler } from './runtime/reconciler.js';
 import { inspectToolRegistry } from './runtime/tool-registry-observer.js';
-import { migrateLegacyDataRoot } from './catalog/legacy-root-migration.js';
-import { resolveDataRoot, resolveDshHome, resolveUserRoot } from './catalog/paths.js';
-import { join } from 'node:path';
+import { migratePluginStorage } from './runtime/storage-migration.js';
+import { mountAgentRoleTool } from './runtime/agent-role-router.js';
+import { projectAgentRoles } from './application/project-agent-roles.js';
+import { mountProjectCommands, mountProjectMcp, mountProjectHooks, mountSuiteInstructions } from './runtime/project-runtime.js';
+import { createPanelResources } from './application/panel-resources.js';
+import { resolveDataRoot, resolveUserRoot } from './catalog/paths.js';
 import { mountSuiteRoutes } from './routes.js';
 import { MCP_SETTINGS_NAMESPACE, MarketSettingsSchema, readMcpBackend } from './runtime/mcp-backend.js';
 import { narrowDownloadRegion } from './runtime/regions.js';
 import { SuiteSkillProvider } from './runtime/skills-provider.js';
 import { loadLspServers } from './runtime/lsp-direct-config.js';
+import { loadDisabledLspServers } from './runtime/lsp-server-state.js';
 import { bindHostLocale, loadHostLocale } from './runtime/host-locale.js';
+import { mountFeedbackTool } from './runtime/feedback-tool.js';
+import { createUserPanelStores } from './runtime/user-panels.js';
+import { UserPanelSkillProvider } from './runtime/user-panels.js';
+import { UserCommandMountRegistry } from './runtime/user-commands.js';
 export const name = 'dsh-agent-plugins-market';
 export const inject = ['skills', 'commands'];
-export function apply(ctx, config = {}) {
+export async function apply(ctx, config = {}) {
     const userRoot = resolveUserRoot(config.userRoot);
     const dataRoot = resolveDataRoot(config.dataRoot, userRoot);
-    // The pre-0.5.4 layout kept a sibling `agent-plugins-data` root; fold it in.
-    void migrateLegacyDataRoot(join(resolveDshHome(), 'agent-plugins-data'), dataRoot).catch(error => {
-        ctx.logger?.warn?.(`[dsh-agent-plugins-market] legacy data-root migration failed: ${String(error)}`);
-    });
+    const migration = await migratePluginStorage(config);
+    if (migration.conflicts.length > 0)
+        throw new Error(`Plugin storage migration conflicts (original files retained): ${migration.conflicts.join(', ')}`);
     let providerControl;
+    let userPanelControl;
     // Host runtime copy resolves from the harness `locale.preference` setting;
     // the async settings read lands before the first session starts in practice.
     const t = bindHostLocale(undefined);
     void loadHostLocale().then(locale => {
         hostLocale.t = locale.t;
         providerControl?.invalidate();
+        userPanelControl?.invalidate();
     });
     const hostLocale = { t };
+    /** Settings watchers to release at teardown (backend watch + feedback switch). */
+    const settingsWatchers = [];
     const runtime = new RuntimeReconciler(ctx, dataRoot, key => hostLocale.t(key));
-    const reconcileMounts = async () => {
+    // User panel stores (skills / commands / agent personas) and their runtime
+    // contributions: one extra skill provider plus one command mount registry.
+    const panels = createUserPanelStores(userRoot);
+    const userCommands = new UserCommandMountRegistry(ctx, panels.commands, key => hostLocale.t(key));
+    let disposed = false;
+    let projectCommands;
+    let projectMcp;
+    let projectHooks;
+    let suitePrompts;
+    let reconcileRequested = false;
+    let reconciliation;
+    const reconcileOnce = async () => {
         try {
-            const snapshot = await catalog.readUserCatalog();
-            const diagnostics = await runtime.reconcile(snapshot.enabledSuites);
+            const suites = await catalog.enabledUserSuites();
+            if (disposed)
+                return;
+            const diagnostics = await runtime.reconcile(suites);
             catalog.mcpDiagnostics = diagnostics.mcp;
             for (const diagnostic of diagnostics.mcp) {
                 ctx.logger?.warn(`[dsh-agent-plugins-market] suite "${diagnostic.suiteId}" mcp server "${diagnostic.serverKey}": ${diagnostic.reason}`);
@@ -56,6 +80,26 @@ export function apply(ctx, config = {}) {
             throw error;
         }
     };
+    // Settings, credential and catalog events can arrive during a slow MCP
+    // connection. Keep one current pass and one fresh follow-up, not a queue
+    // of stale snapshots that all reconnect the same servers.
+    const reconcileMounts = () => {
+        if (disposed)
+            return Promise.resolve();
+        reconcileRequested = true;
+        reconciliation ??= (async () => {
+            try {
+                do {
+                    reconcileRequested = false;
+                    await reconcileOnce();
+                } while (reconcileRequested && !disposed);
+            }
+            finally {
+                reconciliation = undefined;
+            }
+        })();
+        return reconciliation;
+    };
     /**
      * Coalesce credential updates.
      *
@@ -78,7 +122,17 @@ export function apply(ctx, config = {}) {
         }
     };
     const onChanged = async () => {
+        if (disposed)
+            return;
         providerControl?.invalidate();
+        userPanelControl?.invalidate();
+        await projectCommands?.refresh();
+        await suitePrompts?.refresh();
+        await Promise.all([projectMcp?.refresh(), projectHooks?.refresh()]);
+        const userCommandDiagnostics = await userCommands.reconcile().catch(() => []);
+        for (const reason of userCommandDiagnostics) {
+            ctx.logger?.warn(`[dsh-agent-plugins-market] user commands: ${reason}`);
+        }
         await reconcileMounts();
     };
     // The credential store powers the MCP re-authorize action (dropping a grant
@@ -87,6 +141,9 @@ export function apply(ctx, config = {}) {
     // credentials plugin provisions, and a snapshot taken here would be
     // permanently undefined even after the service is live.
     const catalog = new Catalog({ userRoot, dataRoot, onChanged, ...(config.git === undefined ? {} : { git: config.git }) });
+    await catalog.load();
+    await catalog.mergeSources(config.sources ?? []);
+    const resources = createPanelResources(catalog, panels);
     // Mirror oauth.ts's `credentialIdFor`: the record is stored under the folded
     // serverName, so the delete must fold the same way or it misses the record.
     const credentialIdFor = (serverName) => serverName
@@ -101,35 +158,87 @@ export function apply(ctx, config = {}) {
             await store.deleteRecord(`mcp-auth/${credentialIdFor(serverName)}`);
         }
     });
-    runtime.setMcpOverridesProvider(() => catalog.allMcpOverrides());
+    runtime.setMcpOverridesProvider(async () => catalog.allMcpOverrides(await catalog.enabledUserSuites()));
     // Re-authorize must rebuild the live bridge, not just drop the grant: the
     // registry flags the mount and the following reconcile tears it down and
     // remounts, so the server's 401 restarts the browser authorization.
     catalog.setMcpRemountHook((suiteId, serverKey) => runtime.forceMcpRemount(suiteId, serverKey), serverName => runtime.mcpServerOwner(serverName));
     catalog.setLspStatusSource(runtime.lsp);
     runtime.lsp.setDirectProvider(async () => (await loadLspServers(dataRoot)).servers);
+    runtime.lsp.setDisabledProvider(() => loadDisabledLspServers(dataRoot));
     // The MCP backend choice is a host settings namespace (the registration is
     // also what makes the plugin-config tab serve our card). The node half owns
     // it: the provider derives the mount backend from the scope, the writer
-    // flips the switch, and the watcher remounts servers when it flips.
+    // flips the switch, and the watcher remounts servers when it flips. The
+    // same single registration also gates the experience-feedback tool —
+    // `settings.register` throws on a duplicate namespace, so there is exactly
+    // one inject block and one `register` call.
+    //
+    // The whole callback is failure-contained on purpose: a throw here is
+    // INVISIBLE in the UI (the inject resolves asynchronously and cordis only
+    // logs), and it silently removes the namespace from settings.describe —
+    // which is exactly what hides the plugin-config card. Every failure mode
+    // lands in the logger with a loud prefix instead.
+    let feedbackDisposer;
     ctx.inject(['settings'], settingsCtx => {
-        const settings = settingsCtx.settings;
-        const scope = settings.register(MCP_SETTINGS_NAMESPACE, MarketSettingsSchema, {
-            base: { mcpEnhanced: true, downloadRegion: 'auto' }
-        });
-        catalog.setMcpBackendProvider(async () => (scope.get().mcpEnhanced === false ? 'host' : 'builtin'));
-        catalog.setMcpBackendWriter(async (backend) => {
-            await scope.update({ mcpEnhanced: backend !== 'host' });
-        });
-        catalog.setDownloadRegionProvider(async () => narrowDownloadRegion(scope.get().downloadRegion));
-        // One-time migration from the earlier data-root settings.json choice.
-        void readMcpBackend(dataRoot).then(backend => {
-            if (backend === 'host')
-                void scope.update({ mcpEnhanced: false }).catch(() => { });
-        });
-        scope.watch(() => {
-            void reconcileMounts().catch(() => { });
-        });
+        try {
+            ctx.logger?.info?.('[dsh-agent-plugins-market] settings inject resolved — registering namespace');
+            const settings = settingsCtx.settings;
+            const scope = settings.register(MCP_SETTINGS_NAMESPACE, MarketSettingsSchema, {
+                base: { mcpEnhanced: true, downloadRegion: 'auto', feedbackEnabled: true, scanProjectLayouts: true }
+            });
+            ctx.logger?.info?.('[dsh-agent-plugins-market] settings namespace registered — plugin-config card will serve');
+            catalog.setMcpBackendProvider(async () => (scope.get().mcpEnhanced === false ? 'host' : 'builtin'));
+            catalog.setMcpBackendWriter(async (backend) => {
+                await scope.update({ mcpEnhanced: backend !== 'host' });
+            });
+            catalog.setDownloadRegionProvider(async () => narrowDownloadRegion(scope.get().downloadRegion));
+            const syncProjectLayouts = () => {
+                void catalog.setScanProjectLayouts(scope.get().scanProjectLayouts !== false).catch(error => {
+                    ctx.logger?.error?.(`[dsh-agent-plugins-market] project layout reconciliation failed: ${String(error)}`);
+                });
+            };
+            syncProjectLayouts();
+            settingsWatchers.push(scope.watch(syncProjectLayouts));
+            // One-time migration from the earlier data-root settings.json choice.
+            void readMcpBackend(dataRoot).then(backend => {
+                if (backend === 'host')
+                    void scope.update({ mcpEnhanced: false }).catch(() => { });
+            });
+            let previousBackend = scope.get().mcpEnhanced !== false;
+            settingsWatchers.push(scope.watch(() => {
+                const backend = scope.get().mcpEnhanced !== false;
+                if (backend === previousBackend)
+                    return;
+                previousBackend = backend;
+                void Promise.all([reconcileMounts(), projectMcp?.refresh()]).catch(() => { });
+            }));
+            // The experience-feedback model tool: gated by the namespace's
+            // `feedbackEnabled` field (default on); the switch unregisters it. The
+            // tool mount is doubly contained — its failure must never take the
+            // settings namespace (and with it the config card) down with it.
+            const syncFeedbackTool = () => {
+                try {
+                    const state = scope.get();
+                    const wanted = state.feedbackEnabled !== false;
+                    if (wanted && feedbackDisposer === undefined) {
+                        feedbackDisposer = mountFeedbackTool(ctx, dataRoot, (key, params) => hostLocale.t(key, params)) ?? undefined;
+                    }
+                    else if (!wanted && feedbackDisposer !== undefined) {
+                        feedbackDisposer();
+                        feedbackDisposer = undefined;
+                    }
+                }
+                catch (error) {
+                    ctx.logger?.error?.(`[dsh-agent-plugins-market] feedback tool mount failed: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+                }
+            };
+            syncFeedbackTool();
+            settingsWatchers.push(scope.watch(() => syncFeedbackTool()));
+        }
+        catch (error) {
+            ctx.logger?.error?.(`[dsh-agent-plugins-market] settings namespace registration failed — the plugin-config card will be hidden this boot: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+        }
     });
     runtime.setMcpBackendProvider(() => catalog.mcpBackend());
     const eventHost = ctx;
@@ -148,26 +257,69 @@ export function apply(ctx, config = {}) {
         // own server with a clear diagnostic instead of failing mid-registration.
         runtime.setMcpToolNamesProvider(() => inspectToolRegistry(registry).map(tool => tool.name));
     });
-    void catalog
-        .load()
+    void Promise.resolve()
         .then(async () => {
-        await catalog.mergeSources(config.sources ?? []);
+        const userCommandDiagnostics = await userCommands.reconcile().catch(() => []);
+        for (const reason of userCommandDiagnostics) {
+            ctx.logger?.warn(`[dsh-agent-plugins-market] user commands: ${reason}`);
+        }
         await reconcileMounts();
     })
         .catch(() => { });
     ctx.skills.registerProvider(control => {
         providerControl = control;
-        return new SuiteSkillProvider(catalog, key => hostLocale.t(key));
+        return new SuiteSkillProvider(catalog);
+    });
+    // User panel skills ride a second provider so a panel
+    // edit invalidates only its own catalog contribution.
+    ctx.skills.registerProvider(control => {
+        userPanelControl = control;
+        return new UserPanelSkillProvider(panels.skills, key => hostLocale.t(key));
+    });
+    ctx.inject(['tools', 'llm', 'subagents', 'agents'], hostCtx => {
+        hostCtx.effect(() => mountAgentRoleTool(hostCtx, async (parent) => [
+            ...(await resources.agents.list(true)).map(entry => ({ ...entry, title: entry.name, name: entry.id ?? entry.name })),
+            ...(await projectAgentRoles(catalog, parent))
+        ], (key, params) => hostLocale.t(key, params)), 'dsh-agent-plugins-market: agent role routing');
+    });
+    ctx.inject(['agents'], hostCtx => {
+        hostCtx.effect(() => {
+            const mounted = mountProjectCommands(hostCtx, catalog, key => hostLocale.t(key));
+            const mcp = mountProjectMcp(hostCtx, catalog, dataRoot);
+            const hooks = mountProjectHooks(hostCtx, catalog);
+            const prompts = mountSuiteInstructions(hostCtx, catalog);
+            projectCommands = mounted;
+            projectMcp = mcp;
+            projectHooks = hooks;
+            suitePrompts = prompts;
+            return async () => {
+                if (projectCommands === mounted)
+                    projectCommands = undefined;
+                if (projectMcp === mcp)
+                    projectMcp = undefined;
+                if (projectHooks === hooks)
+                    projectHooks = undefined;
+                if (suitePrompts === prompts)
+                    suitePrompts = undefined;
+                await Promise.all([mounted.dispose(), mcp.dispose(), hooks.dispose(), prompts.dispose()]);
+            };
+        }, 'dsh-agent-plugins-market: project command lifecycle');
     });
     ctx.inject(['webServer', 'loader'], hostCtx => {
-        hostCtx.effect(() => mountSuiteRoutes(hostCtx, catalog), 'dsh-agent-plugins-market: http routes');
+        hostCtx.effect(() => mountSuiteRoutes(hostCtx, catalog, resources), 'dsh-agent-plugins-market: http routes');
     });
     ctx.effect(() => () => {
+        disposed = true;
         disposeCredentialUpdates();
         if (credentialFlush !== undefined)
             clearTimeout(credentialFlush);
         credentialFlush = undefined;
         pendingCredentialRefs.clear();
+        for (const dispose of settingsWatchers.splice(0))
+            dispose();
+        feedbackDisposer?.();
+        feedbackDisposer = undefined;
+        userCommands.disposeAll();
         void runtime.dispose();
     }, 'dsh-agent-plugins-market: lifecycle');
 }

package/lib/model/layouts.js

@@ -0,0 +1,49 @@
+/** Ordered layout declarations shared by manifest and project discovery. */
+export const PLUGIN_LAYOUTS = [
+    { kind: 'agent-plugin-v1', manifest: 'plugin.json', marketplaces: [] },
+    { kind: 'universal', manifest: '.plugin/plugin.json', marketplaces: ['.plugin/marketplace.json'] },
+    { kind: 'claude-code', manifest: '.claude-plugin/plugin.json', marketplaces: ['.claude-plugin/marketplace.json'] },
+    { kind: 'cursor', manifest: '.cursor-plugin/plugin.json', marketplaces: ['.cursor-plugin/marketplace.json'] },
+    { kind: 'kimi', manifest: '.kimi-plugin/plugin.json', marketplaces: ['.kimi-plugin/marketplace.json'] },
+    { kind: 'codex', manifest: '.codex-plugin/plugin.json', marketplaces: ['.agents/plugins/marketplace.json', '.agents/plugins/api_marketplace.json'] },
+    { kind: 'zcode', manifest: '.zcode-plugin/plugin.json', marketplaces: [] },
+    { kind: 'qoder', manifest: '.qoder-plugin/plugin.json', marketplaces: ['.qoder-plugin/marketplace.json'] },
+    { kind: 'github-copilot', manifest: '.github/plugin/plugin.json', marketplaces: ['.github/plugin/marketplace.json'] }
+];
+/** Kimi Code's primary spelling precedes its compatibility spelling within that dialect. */
+export const MANIFEST_ALIASES = { kimi: ['kimi.plugin.json'] };
+/** Equivalent plugin-owned path variables; these never resolve as credentials. */
+export const PLUGIN_ROOT_VARIABLES = new Set(['PLUGIN_ROOT', 'CLAUDE_PLUGIN_ROOT', 'CODEX_PLUGIN_ROOT', 'ZCODE_PLUGIN_ROOT', 'QODER_PLUGIN_ROOT']);
+export const PLUGIN_DATA_VARIABLES = new Set(['PLUGIN_DATA', 'CLAUDE_PLUGIN_DATA', 'ZCODE_PLUGIN_DATA', 'QODER_PLUGIN_DATA']);
+export const PROJECT_LAYOUTS = [
+    {
+        dirName: '.claude',
+        label: 'Claude Code',
+        subdirs: ['skills', 'agents', 'commands'],
+        mcpFiles: ['.mcp.json'],
+        hookFiles: ['.claude/settings.json', '.claude/settings.local.json']
+    },
+    { dirName: '.agents', label: 'agents', subdirs: ['skills', 'agents', 'commands'] },
+    { dirName: '.codex', label: 'Codex', subdirs: ['skills'], mcpFiles: ['.codex/config.toml'], mcpFormat: 'codex' },
+    { dirName: '.cursor', label: 'Cursor', subdirs: ['skills', 'agents', 'commands'], mcpFiles: ['.cursor/mcp.json'] },
+    { dirName: '.kimi', label: 'Kimi', subdirs: ['skills'] },
+    {
+        dirName: '.zcode',
+        label: 'ZCode',
+        subdirs: ['skills', 'agents', 'commands'],
+        mcpFiles: ['zcode.json', '.zcode/config.json'],
+        mcpFormat: 'zcode',
+        hookFiles: ['zcode.json', '.zcode/config.json'],
+        hookFormat: 'zcode'
+    },
+    {
+        dirName: '.qoder',
+        label: 'Qoder CLI',
+        subdirs: ['skills', 'agents', 'commands'],
+        mcpFiles: ['.qoder/settings.json', '.qoder/settings.local.json'],
+        hookFiles: ['.qoder/settings.json', '.qoder/settings.local.json']
+    },
+    { dirName: '.github', label: 'GitHub Copilot', subdirs: ['skills', 'agents'] }
+];
+/** Marketplace catalogs follow manifest layout order; the shared root catalog is the fallback. */
+export const MARKETPLACE_PATHS = [...PLUGIN_LAYOUTS.flatMap(layout => layout.marketplaces), 'marketplace.json'];